Subject: [Hipsec] Moving resynch into a separate draft?

From: [email-masked] (Pekka Nikander)
Date: Sun Feb 1 08:24:00 2004

Given that getting the resynch design seems to be hard,
and that it seems that we need some extensions (Unknown SPI)
for the resynch packets anyway, I would suggest moving
resynch into a separate draft in -10.  (Let it stay for -09,
since it is already there, and it might be good to get some
implementation experience.)

IMHO, that would allow easier discussion in the WG, and
would allow the base draft to proceed faster.

Opinions?

--Pekka

PS.  I still have some backlog of earlier messages that
I need to clear out at some point of time.

---

From: [email-masked] (Jan Mikael Melen)
Date: Mon Feb 2 01:53:00 2004

Hi!

> would allow the base draft to proceed faster.

I would also like to see the resynch in separate draft due to that it seems to 
more complex than what one would expect. Here is one example what kind of 
problem scenario I have played around:

If host-A receives a ESP packet containing unknown SPI. Host-A will send a I1 
with  resynch bit true. Now if the host-C wants to be nasty it can send ESP 
packets containing random SPIs from random src addresses and the host-A will 
respond with I1 to these packets. 

Now if the host-C wants to spend the CPU cycles of host-A instead of just 
sending ESP packets it can also send afaik R1 packets (those of course have 
to match with the faik ESP packets). Now host-A thinks that it has received a 
ESP from unknown SPI, host-A has sent a I1 and gotten a R1 back as response 
to the I1. Host-A starts to process R1 and spends some cycles on solving the 
puzzle and in creation of I2 packet.

Now there is a possibility to solve CPU exhausting problem by limiting the 
amount of ongoing HIP negotiations but still the host-C can make sure that 
host-A has the maximium number of HIP negotiations going on all the time.

   BR. Jan

---

From: [email-masked] (Julien Laganier)
Date: Mon Feb 2 09:55:02 2004

> would allow the base draft to proceed faster.

That's fine with me.

Tnx,

--julien